timescale/rsigma

Última actividad de origen registrada: 18 de octubre de 2026 a las 09:33

Catálogo de SkillsMP actualizado: 5 de noviembre de 2026 a las 19:57

skills recopiladas: 1

Estrellas en GitHub: 183
Forks en GitHub: 19

Instalar con un asistente de IA

Copia este prompt en el asistente de IA que estés usando.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/timescale/rsigma.

README del repositorio

Archivo de origen del README: README.md

Leer el README original

Mostrar README completo

<a href="https://github.com/timescale/rsigma"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/timescale/rsigma/main/assets/rsigma-logotype-dark.svg" /> <img src="https://raw.githubusercontent.com/timescale/rsigma/main/assets/rsigma-logotype.svg" alt="RSigma logotype" width="200"/> </picture> </a> A complete Sigma detection engineering toolkit <a href="https://github.com/timescale/rsigma/actions/workflows/ci.yml"><img src="https://github.com/timescale/rsigma/actions/workflows/ci.yml/badge.svg" alt="CI" /></a> <a href="https://rsigma.io"><img src="https://img.shields.io/badge/docs-website-blue" alt="Documentation" /></a> <a href="https://crates.io/crates/rsigma"><img src="https://img.shields.io/crates/v/rsigma.svg" alt="crates.io" /></a> <a href="https://github.com/timescale/rsigma/blob/main/Cargo.toml"><img src="https://img.shields.io/badge/MSRV-1.96.0-blue" alt="MSRV" /></a> <a href="https://ghcr.io/timescale/rsigma"><img src="https://img.shields.io/badge/ghcr.io-rsigma-blue?logo=docker" alt="Docker" /></a> <a href="https://github.com/timescale/rsigma/releases/latest"><img src="https://img.shields.io/github/v/release/timescale/rsigma" alt="GitHub Release" /></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-green.svg" alt="License: MIT" /></a> <a href="https://github.com/rust-unofficial/awesome-rust#security-tools"><img src="https://awesome.re/mentioned-badge.svg" alt="Mentioned in Awesome Rust" /></a> <a href="https://glama.ai/mcp/servers/timescale/rsigma"><img src="https://glama.ai/mcp/servers/timescale/rsigma/badges/score.svg" alt="rsigma MCP server score on Glama.ai" /></a> RSigma is a complete detection engineering toolkit for the [Sigma](https://sigmahq.io/) detection standard, including a parser, evaluation engine, rule conversion, streaming runtime, linter, formatter, CLI, MCP, and LSP. RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It handles stateful correlation logic in-process with memory-efficient compressed event storage. Or as Zack Allen put it in [DEW #149](https://www.detectionengineering.net/i/191079258/detection-engineering-gem), "RSigma is essentially a SIEM." You can send events in many formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. pySigma-compatible processing pipelines handle field mapping and backend configuration. OTLP support lets any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) forward logs to RSigma via HTTP or gRPC for detection. For rule quality and editor integration, a built-in linter validates rules against 90 checks derived from the Sigma v2.1.0 specification, and an LSP server provides real-time diagnostics, completions, hover documentation, quick-fix code actions, and formatting in any editor. RSigma builds on open industry standards throughout: [Sigma](https://sigmahq.io/) for detection rules, [OpenTelemetry](https://opentelemetry.io/) for log ingestion and detection export, and [STIX](https://oasis-open.github.io/cti-documentation/stix/intro) and [TAXII](https://oasis-open.github.io/cti-documentation/taxii/intro) for threat intelligence. Full documentation, including guides, CLI reference, and library API docs, lives at [rsigma.io](https://rsigma.io/). ![Detection Engineering Loop](assets/detection-loop.svg) ## Supported Features ### Author * **[Sigma parsing](https://rsigma.io/library/parser/):** Parses Sigma YAML into a strongly-typed AST with support for detection, correlation, and filter rules * **[Array matching](https://rsigma.io/guide/array-matching/) (experimental):** Matches members of arrays in nested event data with any/all-member semantics, same-element correlation, and positional indexing, opt-in via `sigma-version: 3` * **[Rule drafting](https://rsigma.io/guide/rule-drafting/):** Drafts detection rules and temporal correlations from exemplar events contrasted against a baseline corpus with `rule draft` * **[Rule tuning](https://rsigma.io/guide/rule-tuning/):** Proposes a spec-native filter from false-positive events, verifies that every known true positive still fires, and refuses unsafe separators with `rule tune` * **[Built-in linter](https://rsigma.io/guide/linting-rules/):** Validates rules with 90 checks, four severity levels, suppressions, custom tag namespaces, and auto-fix for 14 safe rules * **[Formatter](https://rsigma.io/guide/formatting-rules/):** Rewrites rules into one canonical layout with `rule fmt`, keeps comments, and refuses any change to what a rule means * **[ADS metadata](https://rsigma.io/guide/detection-strategy/):** Documents rules with [Palantir ADS](https://github.com/palantir/alerting-detection-strategy-framework) sections under `rsigma.ads.*`, enforced by the linter and scaffolded with `rule doc` * **LSP server:** Provides real-time diagnostics, completions, hover documentation, document symbols, quick-fix code actions, and formatting in [VSCode](https://rsigma.io/editors/vscode/), [Neovim](https://rsigma.io/editors/neovim/), and any LSP-capable editor * **[MCP server](https://rsigma.io/guide/mcp-server/):** Exposes the toolchain to AI agents (Cursor, Claude Code, ...) as structured MCP tools over stdio or Streamable HTTP with `rsigma mcp serve` ### Test * **[Detection diagnostics](https://rsigma.io/cli/engine/explain/):** Explains why a rule did or did not match an event with `engine explain`, diffs pipeline transformations with `pipeline diff`, and introspects live correlation windows * **[Corpus backtesting](https://rsigma.io/cli/rule/backtest/):** Replays an event corpus against declared per-rule expectations with `rule backtest`, emitting a JSON or JUnit XML report for CI * **[Output formats](https://rsigma.io/reference/output/):** Structured commands render JSON, NDJSON, table, CSV, or TSV with a TTY-aware default via a global `--output-format` flag; artifact and protocol commands keep their fixed wire format (see the per-command contract) ### Deploy * **[CI integration](https://rsigma.io/guide/ci-cd/):** Gates a rule repository in one pull-request check with the [`timescale/rsigma-action`](https://github.com/timescale/rsigma-action) GitHub Action, wrapping lint, validate, fields-drift diff, backtest, and coverage * **[Configuration](https://rsigma.io/reference/configuration/):** Layers settings from YAML config files, environment variables, and CLI flags, managed with the `rsigma config` command group * **[Signed artifacts](https://rsigma.io/deployment/docker/):** Ships multi-arch Docker images with cosign signatures, SBOM, and SLSA Build L3 provenance, plus prebuilt binaries for Linux, macOS, and Windows ### Detect * **[Rule evaluation](https://rsigma.io/guide/evaluating-rules/):** Compiles rules into optimized matchers and evaluates them against events in real time, with stateless detection and stateful correlation (sliding/tumbling/session windows, group-by, chaining, suppression) * **[Streaming daemon](https://rsigma.io/guide/streaming-detection/):** Runs as a long-lived detection daemon with hot-reload, Prometheus metrics, stdin/HTTP/NATS/OTLP/Unix-socket input, and async sinks (stdout, file, NATS, OTLP, webhook, Unix socket) with per-sink retry, DLQ, and a per-sink wire format (native NDJSON or [OCSF Detection Finding](https://rsigma.io/guide/ocsf-findings/) JSON) * **[Input formats](https://rsigma.io/guide/input-formats/):** Ingests JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP logs with format auto-detection * **[Processing pipelines](https://rsigma.io/guide/processing-pipelines/):** Maps fields and transforms rules with pySigma-compatible pipelines (transformations, conditions, finalizers) * **[Dynamic pipelines](https://rsigma.io/reference/dynamic-sources/):** Populates any pipeline value from external sources (HTTP, files, commands, NATS) with template expansion, auto-refresh, and extraction via jq, JSONPath, or CEL * **[Schema recognition](https://rsigma.io/cli/engine/classify/):** Recognizes which schema each event uses (ECS, Sysmon, CEF, OCSF, or user-defined) with `engine classify`, watches a live daemon for unrecognized sources, and mines candidate signatures with `engine discover-schemas` * **[Schema routing](https://rsigma.io/guide/schema-routing/):** Builds one engine per pipeline set and dispatches each classified event to its engine, feeding a shared correlation store * **[Logsource routing](https://rsigma.io/guide/logsource-routing/):** Skips rules whose logsource conflicts with an event's declared `product`/`service`/`category`, so a mixed-product stream only pays for the rules that can match * **[Eval prefilters](https://rsigma.io/guide/performance-tuning/):** Prunes large rule sets before evaluation with a bloom substring prefilter and a cross-rule Aho-Corasick index * **[NATS JetStream](https://rsigma.io/guide/nats-streaming/):** Consumes and publishes over JetStream with authentication (credentials, mTLS), replay, consumer groups, and dead-letter queues * **[OTLP integration](https://rsigma.io/guide/otlp-integration/):** Receives logs from any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) via HTTP or gRPC, and exports detections to an OTLP collector * **[TLS termination](https://rsigma.io/reference/security/):** Terminates TLS in-process on the daemon API listener with optional mutual TLS and cross-platform certificate hot-reload, and refuses to expose a plaintext or unauthenticated API on a non-loopback address without an explicit opt-out * **[State persistence](https://rsigma.io/guide/streaming-detection/):** Persists correlation, alert-pipeline, risk, and disposition state to SQLite with `--state-db` and restores it across restarts. The capture ring is not persisted. * **Live operations:** Inspects a running daemon with [`engine status`](https://rsigma.io/cli/engine/status/), records replayable fixtures with [`engine tap`](https://rsigma.io/cli/engine/tap/), and streams live detections with [`engine tail`](https://rsigma.io/cli/engine/tail/) ### Alert & Triage * **[Enrichment](https://rsigma.io/guide/enrichers/):** Injects context (asset info, IP reputation, identity, GeoIP, runbook URLs, ...) into detection and correlation results via `template`, `lookup`, `http`, and `command` primitives * **[Risk-based alerting](https://rsigma.io/guide/risk-based-alerting/):** Scores each firing per entity (user, host, source IP) and raises a single incident when an entity's accumulated risk crosses a threshold * **[Alert pipeline](https://rsigma.io/guide/alert-pipeline/):** Silences, inhibits, and deduplicates results, then groups the survivors into incidents, modeled on Alertmanager * **[Webhook alerts](https://rsigma.io/guide/webhooks/):** Delivers detections to Slack, Teams, Discord, PagerDuty, or any HTTP endpoint with templated payloads, HMAC request signing, per-webhook retry, rate limiting, and DLQ * **[Triage feedback](https://rsigma.io/guide/triage-feedback/):** Ingests analyst dispositions into a per-rule false-positive ratio that feeds the detection scorecard * **[Verdict-driven corpora](https://rsigma.io/guide/verdict-to-corpus/):** Retains admitted `group_by` detection events and writes TP/FP bundles after an accepted disposition for `rule backtest` and `rule tune --from-dispositions` ### Measure * **[ATT&CK coverage](https://rsigma.io/guide/attack-coverage/):** Exports an ATT&CK Navigator layer with `rule coverage` and reports gaps against Atomic Red Team, the SigmaHQ baseline, and a target technique list * **[Telemetry visibility](https://rsigma.io/guide/visibility-and-data-sources/):** Scores data-source maturity with `rule visibility`, exporting [DeTT&CT](https://github.com/rabobank-cdc/DeTTECT) administration files and a Navigator layer that surfaces blind spots * **[Field observability](https://rsigma.io/guide/observability/):** Surfaces which event fields no rule references and which rule fields never appear in events, live on the daemon or as a one-shot report from `engine eval` * **[Detection scorecard](https://rsigma.io/guide/detection-scorecard/):** Fuses backtest, coverage, production-volume, and triage signals with `rule scorecard` into per-rule keep/tune/retire verdicts * **[Rule hygiene](https://rsigma.io/guide/rule-hygiene/):** Flags retirement candidates with `rule hygiene`: silent, noisy, untagged, unowned, incomplete ADS, broken field coverage, or stale status ### Hunt * **[Rule conversion](https://rsigma.io/guide/rule-conversion/):** Converts rules into backend-native queries via a pluggable backend trait, with native PostgreSQL/TimescaleDB, LynxDB, and Fibratus backends plus sigma-cli delegation for 30+ pySigma backends (Splunk, Elasticsearch, Microsoft Sentinel, ...) * **[Hunt execution](https://rsigma.io/guide/hunting/):** Runs converted detection rules read-only against a PostgreSQL/TimescaleDB archive with `hunt run` and streams matching rows back as exemplar-shaped NDJSON that `rule draft`, `rule tune`, `rule test`, and `rule backtest` consume directly * **[Field catalog](https://rsigma.io/cli/rule/fields/):** Lists every field a ruleset references, before or after pipeline mapping, with `rule fields` ## Crates | Crate | Description | |-------|-------------| | [`rsigma-parser`](crates/rsigma-parser/) | Parse Sigma YAML into a strongly-typed AST | | [`rsigma-ir`](crates/rsigma-ir/) | Intermediate representation shared by evaluation and conversion | | [`rsigma-eval`](crates/rsigma-eval/) | Compile and evaluate rules against JSON events | | [`rsigma-convert`](crates/rsigma-convert/) | Transform rules into backend-native query strings | | [`rsigma-runtime`](crates/rsigma-runtime/) | Streaming runtime with input adapters, log processor, and hot-reload | | [`rsigma-mcp`](crates/rsigma-mcp/) | Model Context Protocol (MCP) server exposing the toolchain as tools for AI agents | | [`rsigma`](crates/rsigma-cli/) | CLI for parsing, validating, linting, formatting, evaluating, converting rules, field catalog, and running a detection daemon | | [`rsigma-lsp`](crates/rsigma-lsp/) | Language Server Protocol (LSP) server for IDE support | | [`rstix`](crates/rstix/) | STIX 2.1 library: typed objects, bundle parse/stream, semantic validation, and pattern engine | > [!TIP] > To learn more about RSigma, watch [Detection Engineering with RSigma](https://www.youtube.com/watch?v=cqeYdA39qv0) from Linux Security Summit Europe 2026 ([talk page](https://lsseu2026.sched.com/event/2WHc4), [slides](https://hosted-files.sched.co/lsseu2026/d0/talk.pdf), [demo and materials](https://github.com/mostafa/rsigma-lss-eu-2026-talk)), and read these articles: > > - [Pattern Detection and Correlation in JSON Logs](https://mostafa.dev/pattern-detection-and-correlation-in-json-logs-fab16334e4ee) > - [Streaming Logs to RSigma for Real-Time Detection](https://mostafa.dev/streaming-logs-to-rsigma-for-real-time-detection-72084b8041ad) > - [Building a Detection Layer on PostgreSQL with Sigma Rules](https://mostafa.dev/building-a-detection-layer-on-postgresql-with-sigma-rules-042caeb42b2a) > - [Security Observability with RSigma and the LGTM Stack](https://mostafa.dev/security-observability-with-rsigma-and-the-lgtm-stack-375ccd260795) > - [Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines](https://mostafa.dev/wiring-live-threat-intel-into-sigma-detection-with-dynamic-pipelines-4de29b4af7ca) > - [Cloud Detection at Scale on a Laptop](https://mostafa.dev/cloud-detection-at-scale-on-a-laptop-e46540322856) > - [The State of RSigma](https://mostafa.dev/the-state-of-rsigma-7ba0a99020d9) > - [Detection-as-Code in One GitHub Action with RSigma](https://mostafa.dev/detection-as-code-in-one-github-action-with-rsigma-0ebfb4c857fa) > - [The State of RSigma, Part Two: The Loop](https://mostafa.dev/the-state-of-rsigma-part-two-the-loop-c114f379dd78) > [!NOTE] > RSigma has been featured in: > > - [Detection Engineering Weekly #149](https://www.detectionengineering.net/i/191079258/detection-engineering-gem) (March 2026) > *"RSigma is essentially a SIEM. Building a tool like RSigma is challenging because the Sigma specification has evolved into a robust domain-specific language over the years."* > - [tl;dr sec #320](https://tldrsec.com/p/tldr-sec-320#blue-team) (March 2026) > *"Accurately evaluating the full spectrum of what Sigma rules can express is quite complex. It's pretty neat to read about how RSigma handles all of these conditional expressions, correlating across rules, etc."* > - [The Deep Purple Sec by BlackNoise](https://www.blacknoise.co/the-deep-purple-sec-march-2026/) (March 2026) > *"Defensive teams can pipe logs through CLI commands, apply field-mapping pipelines, and chain correlations for multi-stage attack detection."* > - [Detection Engineering Weekly #154](https://www.detectionengineering.net/i/195467950/state-of-the-art) (April 2026) > *"RSigma is not a SIEM, but it's an impressive feat to build a self-contained Rust binary that operates much like one. For teams doing pre-SIEM rule validation or forensics, it's a solid plug-and-play option."* > - [Detection Engineering Weekly #157](https://www.detectionengineering.net/p/dew-157-shai-hulud-goes-open-source) (May 2026) > *"Instead of hardcoding IOC values in rule YAML, you declare external sources in the pipeline config, and RSigma fetches and injects them at evaluation time."* > - [This Week in Rust 663](https://this-week-in-rust.org/blog/2026/08/05/this-week-in-rust-663/) (August 2026) > Featured the [RSigma v0.20.0 release](https://github.com/timescale/rsigma/releases/tag/v0.20.0), [The State of RSigma](https://mostafa.dev/the-state-of-rsigma-7ba0a99020d9), and [Part Two: The Loop](https://mostafa.dev/the-state-of-rsigma-part-two-the-loop-c114f379dd78). > - [Rust Bytes #139](https://weeklyrust.substack.com/p/whats-new-in-1990) (October 2026) > Featured RSigma in the Project Spotlight. ## Installation Prebuilt binaries for Linux, macOS, and Windows (amd64 and arm64), with SLSA Build L3 provenance, are attached to every [GitHub release](https://github.com/timescale/rsigma/releases/latest). Or install from crates.io: ```bash # Install the CLI cargo install --locked rsigma # Install the LSP server cargo install --locked rsigma-lsp ``` To build from source: ```bash cargo build --release --all-features --workspace ``` ### Docker Multi-arch images (linux/amd64, linux/arm64) are published to GHCR on every release, signed with cosign and carrying an SPDX SBOM and SLSA Build L3 provenance. See the [Docker deployment guide](https://rsigma.io/deployment/docker/). ```bash docker pull ghcr.io/timescale/rsigma:latest docker run --rm ghcr.io/timescale/rsigma:latest --help ``` Run with full runtime hardening: ```bash docker run --rm \ --read-only \ --cap-drop=ALL \ --security-opt=no-new-privileges:true \ -v /path/to/rules:/rules:ro \ ghcr.io/timescale/rsigma:latest rule validate /rules/ ``` Verify the image signature: ```bash cosign verify \ --certificate-identity-regexp 'github.com/timescale/rsigma' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ ghcr.io/timescale/rsigma:latest ``` ## Quick Start ```bash # Evaluate a single event against Sigma rules rsigma engine eval -r rules/ -e '{"CommandLine": "cmd /c whoami"}' # Stream NDJSON from stdin (auto-selected when stdout is piped) cat events.ndjson | rsigma engine eval -r rules/ # Interactive triage in a terminal: width-aligned table view rsigma engine eval -r rules/ -e @events.ndjson --output-format table # Recognize which schema each event is (ECS, Sysmon, CEF, OCSF, ...) cat events.ndjson | rsigma engine classify --output-format table # Pipe a CSV view into a spreadsheet or data tool rsigma engine eval -r rules/ -e @events.ndjson --output-format csv > matches.csv # Run as a daemon with hot-reload and Prometheus metrics rsigma engine daemon -r rules/ -p ecs.yml --api-addr 127.0.0.1:9090 # Accept events via HTTP POST (a non-loopback --api-addr also needs TLS and an API token) rsigma engine daemon -r rules/ --input http --api-addr 127.0.0.1:9090 # Check a running daemon's status (rules loaded, events processed, uptime) rsigma engine status # Record 30s of a running daemon's live events to a replayable fixture # (opt-in: start the daemon with --enable-tap) rsigma engine tap --duration 30s --redact-fields user.email,src_ip -o fixture.ndjson # Stream a running daemon's live detections to the terminal # (opt-in: start the daemon with --enable-tail) rsigma engine tail --level high # Convert rules to PostgreSQL SQL for historical threat hunting rsigma backend convert rules/ -t postgres # Any non-native target delegates to sigma-cli when it is installed (pipx install sigma-cli) rsigma backend convert rules/ -t splunk # Draft a detection rule from exemplar events, contrasted against a baseline corpus rsigma rule draft -e @incident.ndjson --baseline @normal-day.ndjson # Draft a temporal correlation from grouped, timed exemplars rsigma rule draft --groups @observed.ndjson --negative @benign.ndjson # Backtest a corpus against per-rule expectations (CI fixture harness) rsigma rule backtest -r rules/ --corpus ci/corpus/ --expectations ci/expectations.yml # Map coverage onto MITRE ATT&CK: export a Navigator layer and gate on a target list rsigma rule coverage -r rules/ --navigator coverage.json --targets threat-model.txt --fail-on-gaps ``` See the [Quick Start guide](https://rsigma.io/getting-started/quick-start/) for a guided tour and the [CLI README](crates/rsigma-cli/) for complete documentation of all subcommands and flags. ### MCP Server (AI agents) Expose the toolchain to MCP-aware agents (Cursor, Claude Code, ...) over stdio: ```bash # Run the MCP server (register it in your agent's mcp.json / via `claude mcp add`) rsigma mcp serve --rules-dir rules/ ``` The agent then calls structured tools (`parse_rule`, `lint_rules`, `validate_rules`, `evaluate_events`, `convert_rules`, `list_fields`, ...) and gets back JSON. Point `--daemon-url` at a running daemon to add the Operate-cycle tools. See the [MCP server guide](https://rsigma.io/guide/mcp-server/). To teach an agent the current CLI and that loop, install the skill (Sigma YAML authoring is a separate skill): ```bash npx skills add timescale/sigma-rules -g -y npx skills add timescale/rsigma -g -y ``` ### Library Usage Use the crates directly from Rust: ```rust use rsigma_parser::parse_sigma_yaml; use rsigma_eval::Engine; use rsigma_eval::event::JsonEvent; use serde_json::json; let yaml = r#" title: Detect Whoami logsource: product: windows category: process_creation detection: selection: CommandLine|contains: 'whoami' condition: selection level: medium "#; let collection = parse_sigma_yaml(yaml).unwrap(); let mut engine = Engine::new(); engine.add_collection(&collection).unwrap(); let event = JsonEvent::borrow(&json!({"CommandLine": "cmd /c whoami"})); let matches = engine.evaluate(&event); assert_eq!(matches[0].rule_title, "Detect Whoami"); ``` ## Architecture ![RSigma streaming detection architecture](assets/architecture.svg) A Sigma rule is parsed into a strongly-typed AST (`rsigma-parser`), lowered into a shared intermediate representation (`rsigma-ir`), then compiled and evaluated against live events (`rsigma-eval` inside `rsigma-runtime`), converted into backend-native queries (`rsigma-convert`), or served to editors and AI agents (`rsigma-lsp`, `rsigma-mcp`). The evaluation library also powers exemplar-driven rule drafting and verified filter tuning through the CLI and MCP. The full walkthrough, covering every module and all four execution shapes, lives in the [Architecture reference](https://rsigma.io/reference/architecture/). ![RSigma crate dependency graph](assets/internal_architecture.svg) ## Performance RSigma is designed for high-throughput detection. On an Apple M4 Pro: - **Parsing**: 12.4 MiB/s for 1000 rules - **Detection**: 1.12M events/sec (JSON runtime pipeline, 100 rules) - **Correlation**: 501K events/sec (temporal + event-count) - **Dynamic pipelines**: 2.85M events/sec once built (no per-event overhead) See [BENCHMARKS.md](BENCHMARKS.md) for full Criterion results across all subsystems. ## Reference - [pySigma](https://github.com/SigmaHQ/pySigma): reference Python implementation - [Sigma Specification V2.1.0](https://github.com/SigmaHQ/sigma-specification): formal specification - [sigma-rust](https://github.com/jopohl/sigma-rust): Pratt parsing approach - [sigmars](https://github.com/crowdalert/sigmars): correlation support patterns - [sigma_engine](https://github.com/SigmaHQ/sigma_engine): official SigmaHQ Rust library for parsing and matching Sigma rules against events - [pySigma-backend-sqlite](https://github.com/SigmaHQ/pySigma-backend-sqlite): SQLite backend for pySigma (inspiration for the PostgreSQL backend) - [pySigma-backend-athena](https://github.com/SigmaHQ/pySigma-backend-athena): AWS Athena backend for pySigma (SELECT fields, CTE-based correlation, sliding window patterns) ## License MIT

Cargando el README del repositorio…

Skills en este repositorio

clasificación pendiente

skill

ocupación

descripción

actualizado

rsigma

sin clasificar

Use the rsigma CLI and MCP server: engine eval, engine daemon, rule lint, rule draft, rule tune, rule backtest, backend convert, mcp serve. Prefer MCP tools when rsigma mcp serve is connected. For authoring Sigma YAML (detection, correlation, filters,…

Idioma del texto original: inglés

2026-10-18

Mostrando 1 de 1 skills recopiladas.